33 lines
3.7 KiB
PHP
33 lines
3.7 KiB
PHP
<?php
|
|
// C132 deployment-only gate: no providers, DB, jobs, mail, configuration writes or secrets in output.
|
|
ini_set('zend.exception_ignore_args','1');set_exception_handler(function(Throwable $e){fwrite(STDERR,json_encode(['result'=>'blocked','case'=>'C132','error_type'=>$e::class,'reason'=>$e instanceof LogicException?$e->getMessage():'Guard could not verify diagnostics configuration','secret_values_recorded'=>false]));exit(2);});
|
|
function c132GuardValues(array $source,array $effective):void {
|
|
if(($source['devtools']['enabled']??null)!==false)throw new LogicException('Explicit source DevTools OFF required; local fallback is unsafe');
|
|
if(($effective['devtools']['enabled']??null)!==false)throw new LogicException('Effective or cached configuration could enable DevTools');
|
|
}
|
|
function c132GuardConstant(string $code):void {
|
|
$clean='';foreach(token_get_all($code)as$t){if(is_array($t)&&in_array($t[0],[T_COMMENT,T_DOC_COMMENT],true))continue;$clean.=is_array($t)?$t[1]:$t;}
|
|
if(!preg_match('/[\'\"]devtools[\'\"]\s*=>\s*\[\s*[\'\"]enabled[\'\"]\s*=>\s*false\b/',$clean))throw new LogicException('DevTools OFF must be a constant, independent of APP_ENV or environment flags');
|
|
}
|
|
if(in_array('--self-test',$argv,true)){
|
|
$checks=[];foreach(['safe'=>[['devtools'=>['enabled'=>false]],['devtools'=>['enabled'=>false]],false],
|
|
'missing_source'=>[[],['devtools'=>['enabled'=>false]],true],
|
|
'enabled_source'=>[['devtools'=>['enabled'=>true]],['devtools'=>['enabled'=>false]],true],
|
|
'stale_cache_enabled'=>[['devtools'=>['enabled'=>false]],['devtools'=>['enabled'=>true]],true],
|
|
'missing_effective'=>[['devtools'=>['enabled'=>false]],[],true]]as$name=>[$s,$e,$expectBlocked]){
|
|
$blocked=false;try{c132GuardValues($s,$e);}catch(LogicException){$blocked=true;}if($blocked!==$expectBlocked)throw new LogicException('Guard regression: '.$name);$checks[$name]='passed';
|
|
}
|
|
foreach(['constant_false'=>["<?php return ['devtools'=>['enabled'=>false]];",false],
|
|
'comment_only'=>["<?php // 'devtools'=>['enabled'=>false]\nreturn [];",true],
|
|
'environment_switch'=>["<?php return ['devtools'=>['enabled'=>env('DEVTOOLS',false)]];",true]]as$name=>[$code,$expectBlocked]){
|
|
$blocked=false;try{c132GuardConstant($code);}catch(LogicException){$blocked=true;}if($blocked!==$expectBlocked)throw new LogicException('Guard regression: '.$name);$checks[$name]='passed';
|
|
}echo json_encode(['result'=>'passed','case'=>'C132','checks'=>$checks,'active_writes'=>0]);exit;
|
|
}
|
|
$root=dirname(__DIR__);$candidate=null;
|
|
for($i=1;$i<count($argv);$i++){if($argv[$i]==='--root')$root=$argv[++$i]??throw new LogicException('Root argument missing');elseif($argv[$i]==='--candidate-inertia')$candidate=$argv[++$i]??throw new LogicException('Candidate argument missing');else throw new LogicException('Unknown guard argument');}
|
|
$root=realpath($root);if(!$root||!is_file($root.'/vendor/autoload.php')||!is_file($root.'/bootstrap/app.php'))throw new LogicException('Application root cannot be verified');
|
|
require $root.'/vendor/autoload.php';$app=require $root.'/bootstrap/app.php';(new Illuminate\Foundation\Bootstrap\LoadEnvironmentVariables)->bootstrap($app);(new Illuminate\Foundation\Bootstrap\LoadConfiguration)->bootstrap($app);
|
|
$sourcePath=$candidate??$root.'/config/inertia.php';if(!is_file($sourcePath))throw new LogicException('Configuration source absent');c132GuardConstant(file_get_contents($sourcePath));$source=require $sourcePath;
|
|
c132GuardValues($source,config('inertia',[]));
|
|
echo json_encode(['result'=>'passed','case'=>'C132','source_explicit_constant_OFF'=>true,'effective_configuration_OFF'=>true,'configuration_cached'=>$app->configurationIsCached(),'database_connections_used'=>0,'active_writes'=>0]);
|